🚨 Filebeat Error: 'Filebeat is unable to load the ingest pipelines' — Cause, Fix, and Troubleshooting Guide

Overview

During filebeat setup or at startup, Filebeat installs the ingest pipelines its enabled modules require. When that installation fails, it reports:

Exiting: Failed to start crawler: Filebeat is unable to load the ingest pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the ingest pipelines or are using Logstash pipelines, you can ignore this warning.

There are two common shapes. The first, above, appears when modules are enabled but the output is Logstash (or otherwise not a reachable Elasticsearch), so Filebeat cannot reach ES to install pipelines. The second is a privilege or connectivity failure while putting the pipeline. Either way, the module pipelines are not installed, so module data would be rejected downstream with pipeline ... does not exist.

Symptoms

• Filebeat is unable to load the ingest pipelines for the configured modules at startup.
• Message notes the Elasticsearch output is not configured/enabled.
• Occurs when using a logstash output together with enabled modules.
• Or a privilege error (unauthorized) while installing the pipeline.

Common Root Causes

• Logstash output + modules — Filebeat cannot install pipelines without a direct ES output.
• ES output disabled/unreachable during setup.
• Insufficient privileges — the setup user lacks manage_pipeline / ingest admin rights.
• No ingest node available in the cluster.
• Skipped setup — pipelines were expected but never loaded.

How to diagnose

Confirm which output is active and whether modules are enabled:

grep -A3 'output\.\(elasticsearch\|logstash\)' /etc/filebeat/filebeat.yml
filebeat modules list

Verify the setup user can manage pipelines against the cluster:

curl -sk 'https://es01:9200/_security/user/_privileges' -u elastic:$ES_PASS
curl -sk 'https://es01:9200/_nodes/ingest?filter_path=nodes.*.roles' -u elastic:$ES_PASS

Fixes

When shipping via Logstash but using Filebeat modules, load the pipelines out-of-band by pointing setup at Elasticsearch directly, then let Logstash reference them:

filebeat setup --pipelines --modules nginx \
  -E 'output.logstash.enabled=false' \
  -E 'output.elasticsearch.hosts=["https://es01:9200"]' \
  -E 'output.elasticsearch.username=elastic' \
  -E 'output.elasticsearch.password=${ES_PASS}'

In the Logstash elasticsearch output, reference the module pipeline so events flow through it:

output {
  elasticsearch {
    hosts => ["https://es01:9200"]
    pipeline => "%{[@metadata][pipeline]}"   # set by Filebeat module metadata
  }
}

If the failure is privileges, grant the setup user manage_pipeline (cluster privilege) and re-run setup. Restart Filebeat once pipelines are present.

What to watch out for

• With a Logstash output this message can be benign if you already loaded pipelines — but module data needs them somewhere.
• Use a privileged admin user for --pipelines, not the least-privilege shipping user.
• Pipeline names are version-stamped; reload them after a Filebeat upgrade.
• Ensure at least one node has the ingest role.

Related

• Filebeat Error: ‘pipeline with id does not exist’
• Filebeat Error: ‘Failed to start crawler’
• Filebeat Error Guide: ‘could not load index template’